CVE-2026-3854 GitHub flaw enables remote code execution

Critical command-injection vulnerability CVE-2026-3854 in GitHub allows an attacker with push access to achieve remote code execution by injecting crafted push option values into internal metadata. The issue affects GitHub Enterprise Cloud and Enterprise Server variants, can lead to full system compromise or exposure of repositories on shared storage, was patched quickly by GitHub, and researchers reported no confirmed in-the-wild exploitation beyond tests.